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ABSTRACT 


The International Space Station (ISS) is designed with large deployable radiator panels that are 
used to reject waste heat from the habitation modules. Qualification testing of the Heat 
Rejection System (HRS) radiators was performed using qualification hardware only. As a result 
of those tests, over 30 design changes were made to the actual flight hardware. Consequently, a 
system level test of the flight hardware was needed to validate its performance in the final 
configuration. A full thermal vacuum test was performed on the flight hardware in order to 
demonstrate its ability to deploy “on-orbit”. Since there is an increased level of risk associated 
with testing flight hardware, because of cost and schedule limitations, special risk mitigation 
procedures were developed and implemented for the test program. This paper introduces the 
Continuous Risk Management process that was utilized for the ISS HRS test program. Testing 
was performed in the Space Power Facility at the NASA Glenn Research Center, Plum Brook 
Station located in Sandusky, Ohio. The radiator system was installed in the 100-foot diameter by 
122-foot tall vacuum chamber on a special deployment track. Radiator deployments were 
performed at several thermal conditions similar to those expected on-orbit using both the primary 
deployment mechanism and the back-up deployment mechanism. The tests were highly 
successful and were completed without incident. 
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INTRODUCTION 

The International Space Station (ISS) is designed with large, deployable radiator panels that are 
used to reject waste heat from the habitation modules and the power generation equipment. 
There are a total of six Heat Rejection System (HRS) radiators and four Photovoltaic radiators 
(PVR) in the current ISS configuration. Critical thermal vacuum qualification testing of these 
radiators was performed over the past five years at the NASA Glenn Research Center’s Space 
Power Facility (SPF) located at Plum Brook Station in Sandusky, Ohio. During testing of an 
HRS radiator qualification unit from December 1996 through January 1997, there was a problem 
deploying the radiator using the primary deployment mechanism. The thermal gradients 
experienced during the test created mechanical interferences at various panel fittings causing the 
radiator to jam at approximately the 30% deployed condition. Several design changes were 
made to the hardware followed by continued testing of the radiator. Once the qualification 
testing was completed, the final flight units were no longer identical to the qualification unit. 
Since there were differences between the six flight units and the qualification unit, NASA 
decided that the risk of launching the untested flight units was too high. NASA’s prime 
contractor. The Boeing Company, proposed that a thermal vacuum test of one representative 
flight unit be performed in the SPF to demonstrate the functionality of all six flight units. 
Although the testing was intended to mitigate risk during the assembly and operation of the ISS, 
NASA recognized that the test itself would risk damaging the expensive flight hardware. In 
addition, it was important that the costs associated with this test be kept to a minimum. NASA 


decided that it was necessary to perform the test, but with special risk reduction methodologies in 
place. Careful risk management during all phases of the test program was critical to meet the 
requirement of reducing cost while minimizing the risk to the flight hardware. Specifically, the 
Continuous Risk Management process was developed which provided the basis for minimizing 
risk throughout the test program. 

RISK MANAGEMENT AT NASA 

Risk Management, as defined for NASA programs and projects, is an organized, systemic 
decision-making process that efficiently identifies, analyzes, plans, tracks, controls, 
communicates and documents risk in order to increase the likelihood of achieving program and 
project goals. It is applied to critical programs/projects on a continuous basis in order to 
minimize the risk to mission success. The process that NASA uses is depicted in Figure 1. 



Figure 1 

NASA’s Risk Management Model 


This process is termed Continuous Risk Management (CRM) and incorporation of each phase is 
critical for overall success. Here is a brief description of each phase: 


Risk Identification 

A risk is anything that threatens mission success, including safety, cost, schedule and technical 
risks. It is the probability that a project will experience undesirable consequences. Each risk is 
enumerated with a condition and a consequence. It is essential that both condition and 
consequence be identified for each risk so that it is known when there is improvement in the risk 
level (i.e. a removal of the condition or an acceptable lowering of the consequence). 


Risk Analysis 

Each risk is evaluated and categorized so that a prioritized order of risks can be established. This 
prioritization is critical to ensure that the highest ranked risks be addressed prior to lower ranked 
risks. In today’s limited budget atmosphere, this prioritization is essential since funding may not 
be available to address all of the risks, equally. 


Risk Planning 

A plan of action must be decided upon for each risk. There are four options for this planning: 

a. Mitigate - specific actions are planned to eliminate the condition and/or lower the 
consequence; 

b. Research - more data is needed to assess the condition or consequence; 

c. Watch - monitor the risk to determine if the specified condition or consequence will 
occur; 

d. Accept - perform no additional actions to mitigate the risk - the anticipated 
consequence is acceptable with no further action. 


Risk Tracking 

All actions decided upon during the planning phase must be monitored to determine if the 
mitigation is, in fact, achieving the anticipated result. Metrics must be established to accomplish 
this. 


Risk Control 

Summarization of all risk-related activities is reported to the appropriate level of management to 
ensure proper visibility. Re-planning decisions (based on unacceptable results from initial risk 
mitigation efforts) are documented and additional (or back-up) actions are planned to mitigate 
the risk. Additionally, based on the risk-related activities to date, new risks are often identified 
at this point and are tracked appropriately. 


Risk Communication and Documentation 

Open communication between all organizational elements is essential to good risk management. 
Accurate and timely documentation is also required to ensure that risks are successfully 
mitigated. 

OVERVIEW OF THE SPACE POWER FACILITY 

The SPF houses the world’s largest space environment test chamber, measuring 30.5m (100ft) in 
diameter by 37.2m (122ft) high. The facility was designed to test spacebound hardware in a 
simulated low Earth orbit environment. The test chamber has two 15.2m (50ft) square doors and 
can be evacuated to a pressure of 1 x 1 O’ 6 torn Solar radiation can be simulated with a 4 MW 
quartz heat lamp array and solar spectrum can be simulated with a 400 kW arc lamp. A variable 
geometry thermal shroud is used to provide simulated space environment temperatures from 
ambient to -195° C (-320° F). 
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Figure 2 

Cutaway View of the Space Power Facility 



The test chamber is made of aluminum and is surrounded by a vacuum-tight heavy concrete 
enclosure. This unique configuration is essentially an aluminum vacuum chamber enclosed 
within a larger concrete vacuum chamber. The concrete chamber is the primary vacuum barrier 
from atmospheric pressure. Like the aluminum test chamber, the concrete chamber doors have 
15.2m by 15.2m (50ft by 50ft) openings that are sealed with inflatable seals. The space between 
the concrete enclosure and the aluminum test chamber is pumped down to a pressure of 20 torr 
during a test. The chamber vacuum system consists of mechanical roughing pumps and high 
vacuum diffusion pumps. The roughing pump system is two identical systems with five stages in 
each having a total pumping capacity of 61,000 liters/sec (130,000 cfm). The high vacuum 
system is configured with thirty-two 122cm (48in) diameter LN2-baffled, electrically heated, oil 
diffusion pumps (capacity each - 43,000 liters/sec.) which are mounted to the chamber floor. 

The assembly area which is located on the east side of the test chamber is 22.9m (75ft) wide by 
45.7m (150ft) long with a steel frame superstructure and a clear height of 24.4m (80ft). It has a 
25-ton capacity overhead bridge crane and three sets of parallel railroad tracks that extend into 
the test chamber. The disassembly area is 21.3m (70ft) wide by 45.7m (150ft) long with a clear 
height of 23.2m (76ft). It has a remotely controlled 20-ton overhead bridge crane. 


The facility has a large removable cryoshroud 
which is used to simulate the cold 
background temperatures experienced in 
space. The cryoshroud is 12.8m (42ft) wide 
by 24.4m (80ft) long with a ceiling height of 
6.7m (22ft). It has a removable floor section 
that is 12.2m (40ft) wide by 24.4m (80ft) 
long. The cryoshroud floor is mounted on 
trollies that ride on the rail tracks which go 
through the facility. This configuration 
allows for build-up of test hardware in the 
disassembly area on the cryoshroud floor. 
Hard attachment points at various locations 
on the cryoshroud floor were used to mount 
the radiator test hardware. The cryoshroud is 
shown in figure 3 inside the test chamber 
without the end panels installed. 



Cryoshroud Inside Chamber 


The cryogenic system at the SPF is capable of removing up to 14 MW of heat from the facility 
thermal shrouds. There are two liquid nitrogen storage vessels on site. One has the capacity of 
217,000 gal. and the other 28,000 gal. The fill pumps circulate liquid nitrogen to the cryoshroud 
and to the diffusion pump baffles. Liquid nitrogen is used in the diffusion pump baffles to 
minimize the potential of backstreaming silicon oil vapor into the chamber during high vacuum 
conditions. Two 11,000 cfm nitrogen compressors circulate gaseous nitrogen through the 
cryoshroud. The temperature of the shroud can be controlled by adjusting the cold nitrogen gas 
flow rate. During the cold temperature testing of the radiators, over 4000 liters/hour (1000 
gallons/hour) of liquid nitrogen was required. 

The total utility power available to the SPF is 14 MW fed by two separate independent power 
grids to minimize risk due to a power failure. Additional power failure risk reduction is provided 
by an emergency backup diesel generator. The facility also has an online uninterruptable power 
system (UPS) which consists of a battery bank and a 15 kVa dc to ac inverter. This system 
supplies power to critical instrumentation and critical control systems. 

INTERNATIONAL SPACE STATION RADIATOR DESCRIPTION 

The HRS Radiators will be used to reject the waste heat from the ISS habitation modules. A 
total of six HRS radiators will be used on the ISS. Each radiator consists of a base assembly 
with a primary and back-up deployment mechanism, and eight panels that deploy with a scissors- 
arm mechanism. When fully deployed, the radiators are approximately 24m (80ft) long. The 
deployed radiator inside the SPF chamber is shown in figure 4. 

A special deployment track was designed to minimize the gravity effects on the test article 
mechanisms while testing. A frictionless roller was attached to the pivot pins on the scissors-arm 
mechanism. The rollers, which carried the gravitational load of the panels, roll down the 
deployment track with minimal resistance during deployment of the radiator. A support guide 
was used at the top of the scissors-arm mechanism to prevent the panel assembly from moving 
side to side. 

One test requirement was to heat the stowed radiator package prior to deployment. An array of 
infrared quartz lamps was used to generate the necessary heat flux simulating solar heating in 
lower earth orbit. An aluminum structure was built around the radiator package to support the 
lamps which needed to be located in close proximity to the test package. Electromechanical 
actuators were used to move the hinged, front portion of the lamp structure to allow for the 
deployment of the radiator panels. Figure 5 shows the stowed radiator package being heated 
with the quartz lamp assembly during one of the thermal vacuum tests. 

The radiator has a back-up deployment mechanism that is designed to be operated by an 
astronaut using a special extra vehicular activity (EVA) tool similar to a hand held drill motor. 
An EVA simulation motor was designed to provide this function during the thermal vacuum test. 


A remotely controllable, variable speed and torque, stepper motor was used in this design. 


The complete set-up of test hardware and test support equipment was installed on the cryoshroud 
floor in the disassembly area of the facility. In this area, the overhead facility crane was used to 
lift and place hardware on the cryoshroud floor. Once the installation of the hardware was 
complete, the cryoshroud floor was rolled into the chamber on the rail tracks. This was followed 
by the installation of the west end-panel of the cryoshroud. 





Figure 4 

Deployed Radiator 



Figure 5 

Stowed Radiator Heated with Lamps 


RISK MANAGEMENT ACTIVITIES FOR THE ISS RADIATOR TESTS 

Risk Identification Activities 

Various risks were identified for the ISS Radiator Test Program at the SPF. These risks were 
identified as conditions that could lead to three undesirable consequences. The first was the 
possibility for silicon oil contamination of the flight hardware from the high vacuum diffusion 
pumps. Contamination of this sort could cause an unacceptable delay in the test program, as well 



as possible damage to the flight hardware. The second was the possibility of damaging “one-of- 
a-kind” space flight hardware during handling and testing. Mishandling or damage could result 
in extremely negative political exposure, as well as delays and cost overruns to the ISS Program. 
The third was the potential for a failure of specialized or critical facility hardware during the test 
program. Some critical facility hardware was modified to increase reliability, and new test 
support hardware was designed and built specifically for the test. While problems with facility 
hardware might not create a risk of damage to the flight hardware, they could cause test program 
schedule delays. These three overall risk areas were considered to be critical and not acceptable 
without implementation of mitigation actions. 

Risk Mitigation Activities 

Several risk mitigation actions were proposed, discussed, and evaluated. Ultimately, the 
following activities were undertaken for the three overall critical risk areas: 

Can’t Fail Analysis 

The radiator tests scheduled for SPF were considered to be schedule critical. To increase the 
focus on success for these tests, NASA instituted a “Can’t Fail/Won’t Fail” risk reduction 
approach. The “Can’t Fail” process emphasizes a change in paradigm from, “How can we make 
this work” to, “What can we do to make sure we don’t cause a failure”. The process advocates a 
proactive approach to risk mitigation involving joint review of existing policies and procedures 
for ambiguities, examination of interfaces with test hardware for potential faults and effects on 
the hardware, and flowcharting key processes to identify important hardware transition points 
and their hazards. At each step, the team is challenged to answer the question “How could we 
make this fail” 

An element of the “Can’t Fail” process is a thorough review of the basic operational steps needed 
to execute the test program. The goal of the review is to identify activities that could cause 
damage to the flight hardware, and identify corresponding risk mitigation actions. NASA and 
the contractor team conducted a top-level review of all test activities and created a flowchart of 
the primary steps required to conduct the test. The flowchart contained sixty-five steps that 
began with loading the flight hardware on a truck at Lockheed Martin in Dallas, continued with 
processing and testing at Plum Brook, and concluded with delivery of the flight hardware back to 
Dallas. A portion of the flowchart is shown in figure 6. 

Each operational step was characterized as a high, moderate, low, or no-risk activity. A high- 
risk activity was one having the greatest potential for something to go wrong and/or result in 
major damage to the flight hardware. A moderate-risk activity could also result in damage to the 
hardware, but were believed to be less likely to result in a damaging event than a high-risk 
activity. A low-risk activity was an operation which could result in superficial and repairable 
damage to the flight hardware, but unlikely to cause damage when performed by skilled, trained, 
personnel. A no-risk activity was one that had no involvement at all with the flight hardware. 
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Figure 6 

Excerpt from “Can’t Fail” Analysis 


As a result of the review, several risk reduction recommendations were made and subsequently 
carried out. NASA critical lift procedures were implemented for all phases of the test. For 
example, handling of critical test hardware utilizing forklifts received additional scrutiny where 
previously, only crane lifts utilized critical lift procedures. The stowed radiator was encased in 
foam barriers to prevent damage from nearby test preparation activities. Use of heavy tools near 
the radiator was prohibited unless absolutely necessary. All other hand tools were used with 
tethers to prevent dropping. Hard objects that might damage the soft Z-93 radiator paint, such as 
rings, belt buckles and watches, were removed or covered with tape. Hazards inherent in 
transporting flight hardware over highways were thoroughly reviewed and procedures were 
modified to provide around-the-clock supervision of the move. Most importantly, the 
implementation of each risk reduction step involved close communication with the technicians 
and engineers working directly on the hardware. This created a heightened awareness of the 
risks involved with every step of the test program and an appreciation of the need for a “can’t 
fail” mind set. 


Interfaces between the flight hardware and facility test support equipment were also reviewed for 
the potential to cause damage to flight hardware. Thermal, mechanical, and electrical interfaces 
were identified and thoroughly reviewed to determine those that were critical. Three interface 
systems were determined to be especially important, and a Failure Modes and Effects Analysis 
(FMEA) was performed for each. These interface systems were the gaseous nitrogen 
pressurization system, the infrared lamp heater system, and the EVA drive simulator. The 
gaseous nitrogen system was a new system for pressurization of the coolant tubes in the radiator 
and posed both a contamination risk and an over-pressurization risk. The infrared lamp heater 
system had undergone hardware modifications since last used and presented over-temperature 
and schedule risks in the event of a component failure. The EVA drive simulator, which 
provides torque to deploy and retract the radiator through the back-up mechanism, had also 
undergone several modifications since last used and could damage the flight hardware if an 
incorrect torque or drive speed was applied. As a result of the FMEA performed on each system, 
five low-probability single point component failures were identified as having the potential to 
damage the flight hardware. Hardware modifications were made to eliminate the possibility of 
these five single-point failure modes. 

Independent Assessment of the Test Management Plan 

Several organizations were involved with this test including the NASA Glenn Research Center, 
the NASA Johnson Space Flight Center, Lockheed Martin and The Boeing Company. A Test 
Management Plan was written to detail specific responsibilities of all organizations involved 
with the testing activities. An independent review of this plan was conducted by the Glenn 
Research Center Risk Management Office to ensure that all responsibilities were clearly defined 
and that lines of communication were in place for all nominal and off-nominal situations that 
could arise 

Independent Assessment of Possible Silicon Oil Contamination 

Silicon oil diffusion pumps are commonly used in high vacuum facilities. Under certain 
circumstances, it is possible for the silicon oil vapor to backstream into the chamber and 
condense on the surfaces of the test article. For the radiator tests, any amount of oil that might 
be introduced onto the flight hardware could contaminate the radiator surfaces, resulting in 
unacceptable cleaning delays. During a previous test series, there was an occurrence of oil back- 
streaming in the SPF. Several facility modifications were made and operational procedures were 
updated to ensure that this situation would not reoccur. The purpose of the independent 
assessment was to review all activities that had been conducted and make recommendations for 
additional activities to further ensure that no silicon oil contamination could occur during the 
radiator testing. Results of this assessment included the recommendation to perform additional 
facility subsystem testing prior to the arrival of the flight hardware to ensure proper operability 
of all systems. 


Performance of System Tests and Additional Training 


Because flight hardware for a NASA mission critical program was being tested, the utmost care 
was taken to ensure that the facility systems, procedures, and personnel were of the highest 
caliber. Extensive training was conducted to ensure that all responsibilities were clearly 
identified for both nominal and off-nominal events. Critical facility systems such as cooling 
water, instrumentation, emergency power, and vacuum systems were operated and verified. 

Acquisition of Additional Quality Assurance Support 

Specific test-related quality assurance support from the Glenn Research Center Quality 
Assurance Office was utilized to ensure that day-to-day quality-related functions such as 
procedure review and sign-off, cleanliness, nitrogen quality requirements and material control 
were being properly accomplished. Additionally, all checklists and procedures used at the SPF 
were independently reviewed by quality assurance personnel. 

Independent Assessment and Testing of the IR Lamp Actuator and EVA Drive Simulator 

Electromechanical actuators were used in previous tests to move the front structure of the 
infrared lamps away from the front panel to allow for radiator deployments. Several problems 
occurred with the actuators in a cold vacuum environment where the test had to be stopped and 
the test chamber repressurized. The same actuators were used for the flight hardware tests, but 
with extensive modifications to ensure their reliability. An independent review and consultation 
with mechanism experts was conducted to get an assessment and recommendations on the design 
modification. Also a multi-cycle load test of the actuators was performed in a cold environment. 
The EVA drive simulator also experienced problems in previous tests. This is a remotely 
operated drive unit (simulating the astronauts EVA tool) that is used to deploy the radiator 
through the back-up deployment mechanism. Design modifications were made to the unit and 
were thoroughly reviewed. The drive unit was then tested at several speeds and under various 
load conditions. 

Assessment and Review of the Cryogenic Shroud Installation 

The SPF utilizes a removable cryogenic shroud. About one month prior to the ISS radiator tests, 
the facility was used for another test program without the cryogenic shroud installed. It was 
necessary to reinstall and check-out the shroud relatively quickly, prior to installing any Space 
Station flight hardware. Installing the shroud in such a short time frame involved several risk 
areas that warranted special attention. The shroud structure is a large specialized system that, if 
damaged, could not be replaced in time to meet the testing schedule. An independent design and 
operations review was conducted to ensure that all risks associated with the installation and 
check-out procedure were adequately addressed. 


Some of the aforementioned activities provided mitigation for all three risk areas while others 
were focused on a specific risk area. Not all phases of NASA’s Risk Management Model were 
applicable for every activity. For example, the acquisition of additional funds for Facility System 


Tests was a planning activity only. On the other hand, the Can’t Fail Analysis was a 
comprehensive study that encompassed all phases of CRM model. Table 1 depicts the 
relationship of each CRM phase with the above activities. 
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Table 1 

Critical Risk Management Activities 


CONCLUSIONS 

The testing of the ISS HRS radiator was successfully completed, and all test objectives were met. 
These tests provided a high degree of confidence that all six radiator units will deploy once on- 
orbit during the construction of the International Space Station. The Continuous Risk 
Management process was essential in identifying and mitigating the critical risks associated with 
this test program. As a result of the CRM process, no mishaps were encountered during any 
phase of the test program including build-up and disassembly. 
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